Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.559 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 210 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.559

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
Docker-Proxy hubcmdui - Missing Authentication on /api/config CVE-2026-116070	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.18	No
OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure CVE-2026-24898	Network Scanner	Oct 28, 2026	Critical(10)	0.01	0.48	No
MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer CVE-2026-115886	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.26	No
WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure CVE-2026-108123	Network Scanner	Oct 28, 2026	High(7.5)	0.01	0.25	No
Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass CVE-2026-85595	Network Scanner	Oct 28, 2026	Critical(9.8)	0.01	0.53	No
Collabora Built-in CODE Server < 26.4.303 - OS Command Injection CVE-2026-110447	Network Scanner	Oct 28, 2026	Critical(9.2)	0.13	0.97	No
SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter CVE-2026-116167	Network Scanner	Oct 28, 2026	High(7.6)	0.01	0.17	No
NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS CVE-2026-10525	Network Scanner	Oct 27, 2026	High(8.8)	0.01	0.2	No
AhsayCBS <= 10.3.4 - Unauthenticated RCE CVE-2026-105134	Network Scanner	Oct 27, 2026	Critical(10)	0.87	1	No
Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code CVE-2026-116006	Network Scanner	Oct 27, 2026	Critical(9.2)	0.01	0.33	No
danmu_api - Unauthenticated Access to Admin API via Default Token CVE-2026-116485	Network Scanner	Oct 27, 2026	Critical(9.8)	N/A	N/A	No
YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery CVE-2026-116205	Network Scanner	Oct 27, 2026	Medium(5.3)	0.01	0.15	No
Lighter - Config Exposed	Network Scanner	Oct 27, 2026	Medium	N/A	N/A	No
Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload CVE-2024-56829	Network Scanner	Oct 27, 2026	Critical(10)	0.01	0.48	No
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write CVE-2026-18051	Network Scanner	Oct 27, 2026	Critical(10)	0.01	0.48	No
WordPress Bit File Manager < 6.9.1 - Arbitrary File Read CVE-2026-17540	Network Scanner	Oct 26, 2026	High(8.8)	0.01	0.37	No
WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell) CVE-2026-93485	Network Scanner	Oct 26, 2026	High(7.1)	0.01	0.29	No
Paisa < 0.7.8 - Unauthenticated Path Traversal CVE-2026-116067	Network Scanner	Oct 26, 2026	High(7.5)	0.01	0.44	No
mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH) CVE-2026-102878	Network Scanner	Oct 26, 2026	High(8.1)	0.01	0.15	No
WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read CVE-2026-9062	Network Scanner	Oct 26, 2026	Low(3.4)	0.01	0.16	No
Rejetto HTTP File Server 2.4.x - Template Injection CVE-2026-97359	Network Scanner	Oct 26, 2026	Critical(9.8)	0.02	0.73	No
WordPress Media Library Assistant < 3.40 - SQL Injection CVE-2026-16959	Network Scanner	Oct 26, 2026	Medium(6.8)	0.01	0.33	No
WordPress Jetpack < 16.1.3 - Reflected Cross-Site Scripting	Network Scanner	Oct 26, 2026	Medium	N/A	N/A	No
WP Ticket <= 6.0.4 - SQL Injection CVE-2026-9848	Network Scanner	Oct 26, 2026	High(7.5)	0.01	0.52	No
LocalAI < 4.6.0 - Server-Side Request Forgery CVE-2026-59707	Network Scanner	Oct 26, 2026	Critical(9.3)	0.01	0.4	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove